Open source · Runs in your cloud · Early access

Your agents’ home. Your controls.

Secure environments for your agents.

Fort is an open-source environment you install in your own cloud. Bring any container, any framework, any model provider. Each agent lives in its own sandbox and can only do what you allow: which models it uses, which tools it calls with which arguments, and which actions wait for a person. Everything it does lands in a record you can check yourself.

Request early access How it works

Deny by default
Keys never enter the agent
A person signs off on risky actions

acme-prod · project sre Example

Warden · decisions

Starting…

The problem

Agents are ready for real systems. Nobody wants to be the one who let them in.

An agent that can restart a deployment can also delete one. A bad plan, a confused model or a poisoned web page is one tool call away from production, so most agents stay in demos. Fort gives them a place to live where every call is checked against your policy, risky ones wait for a person, and nothing leaves the walls unless you said it could.

How it works

From an empty VM to a governed agent in an afternoon.

1
Raise the walls

Run fort up on one Linux VM in your cloud. It sets up NVIDIA OpenShell for isolation and starts Fort beside it. Nothing phones home.
2
Move your agents in

Declare each agent as code: its image, its model providers, its tools and its rules. fort apply runs each one in its own sandbox.
3
Warden keeps the gate

Every tool call is checked, argument by argument: allow, ask or deny. An ask waits for a named person to approve from Slack.
4
Check the record

Every call, allowed or not, goes into a hash-chained ledger. fort ledger verify checks it on an auditor's laptop, offline.

Policy as code

Rules you can read, review and diff.

Agents, tools and rules live in a repo and go through review like any other change.

A call that matches no rule is denied.
Deny beats ask, and ask beats allow.
fort explain agent prints what an agent can and can't do, generated from the policy that's enforced.

policy/projects/sre/agents/sre-agent.yamlExample

kind: Agent
name: sre-agent
image: ghcr.io/acme/sre-agent@sha256:…
providers: [anthropic]  # the key stays outside
egress: []                 # no other network
tool_access:
  - server: ops
    rulesets: [ops-read]
    rules:
      - id: remediation
        tools: [restart_deployment, rollback_deployment]
        when:
          - { arg: $.namespace, in: [checkout, payments] }
        outcome: ask
        reason: change_requires_approval
        ask:
          expiry: 15m
          summary: Restart or roll back a deployment

The walls

Every wall is one you can check.

A sandbox per agent

Each agent runs in its own OpenShell sandbox: non-root, Landlock and seccomp, with default-deny egress per binary.

Keys stay outside

Model keys and tool credentials never enter the agent. They are added at the edge, and only for hosts you allowed.

Argument-level tool policy

restart_deployment only in staging. db.query only SELECT. Nothing that matches *delete*.

A person signs off

An ask waits for a named approver with a fresh sign-in the AI can't fake. The grant covers that exact call, once.

One stop switch

Stop one agent or all of them from the CLI, an MCP client or Slack. A stop survives restarts.

Evidence, not promises

A hash-chained ledger with signed checkpoints. If Fort can't record a decision, the action is denied.

It tries to escape, on purpose

fort doctor --probe sends in a probe agent that tries every way out. Any attempt that works fails the install.

Your people, your roles

Sign in with your identity provider. Built-in and custom roles, per project. Deploying an agent can never make anyone admin.

Any OCI image
Anthropic
OpenAI
AWS Bedrock
Google Vertex
Azure OpenAI
vLLM · Ollama
Slack
OIDC

You hold the keys. Fort holds the walls.

Open source

All of it, in your cloud.

Fort will be Apache-2.0 when it launches: no enterprise edition and no feature gates. It runs entirely in your cloud with no telemetry, and builds on NVIDIA OpenShell through its published extension points only.

$ fort up

$ fort login

$ fort provider add anthropic

$ fort init --example sre

$ fort apply

sre-agent running in its own sandbox

$ fort ledger verify

chain intact

Early access

Move your first agent in.

We're working with a few platform and security teams before launch. Tell us what you want your agents to do, and we'll be in touch.

What you'll need

A Linux VM in your cloud (Ubuntu 24.04)
An agent packaged as a container image, any framework
A key for one model provider